From nobody Sun Jun 11 20:20:27 2023 X-Original-To: bugs@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4QfR5R3SG1z4ctQT for ; Sun, 11 Jun 2023 20:20:27 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4QfR5R0D0tz3Jty for ; Sun, 11 Jun 2023 20:20:27 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1686514827; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=jVnEujpC2/UxWmwugxSZwxxksf2RPkOQzQf62SJuE/o=; b=rMNBdkl3f+W8swODQsXpUhh0grE9poOqwXJYEtalrUPLxHWPjdpEtm6go+llx5hkLfv1UU 8nq/RIQzewJhu+8KIbnVWhuBK6PwS9WjCTAp/l/dr7brTZSuOOi7Pssa0axqvjZIpBfsDS tx0l1Yv46Y0gNBjFwVtit4RgH88hZ9Pb3PpwwZAYMmjTn4C3CQbFhv691jhirVWis13Miq b+kPgPCa0fiF/Jny82R3EJ1YWlEdx0TrAa/UO0xgmd/c/tmXJQ3g7stEyxo/4mati/OokV yvrWh9xMywLho5EtHhR9bn9T0FNWKVg+v6lNT/UvD938RmGriIVzK83FLdVOqA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1686514827; a=rsa-sha256; cv=none; b=Ngt5BTge71LKrPukOE1rQI4YP0xgAPQF4a7itVvX0XKVegAcHDYLdEaJnVgxT3RMCmRyc/ 3/FPqFOhp/FpfuO+Qlh5NJTkkyk4zKcHQJ1zMWLkhwy3PcgqKaCe2sF3ifQoDcIBPc2RPt KLRYTGnHvLk6LiJg16xiVSSeb+G0zrHodCdYYbTOgHK2YkrUlg06/wB1Bv62z4wgbbECJT jiX9qqsD0IPhkvB+w0FB9ab8Ve4qqVW8fLus5gsBhgj9m8h/U4JouUl3L7gZiY4leQc6Ak bVWheEszZXQRjNghgYAqwJ4Gn7o1NOIML/JOyrVZhGqDgzNgdAS0s2iIeEACcA== Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4QfR5Q6PWHz1BQL for ; Sun, 11 Jun 2023 20:20:26 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 35BKKQYJ052708 for ; Sun, 11 Jun 2023 20:20:26 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 35BKKQIY052707 for bugs@FreeBSD.org; Sun, 11 Jun 2023 20:20:26 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 271955] a CHAP challenge packet can overflow a buffer in ppp Date: Sun, 11 Jun 2023 20:20:27 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: bin X-Bugzilla-Version: CURRENT X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: rtm@lcs.mit.edu X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter attachments.mimetype attachments.created Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Bug reports List-Archive: https://lists.freebsd.org/archives/freebsd-bugs List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-bugs@freebsd.org MIME-Version: 1.0 X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D271955 Bug ID: 271955 Summary: a CHAP challenge packet can overflow a buffer in ppp Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Severity: Affects Some People Priority: --- Component: bin Assignee: bugs@FreeBSD.org Reporter: rtm@lcs.mit.edu Attachment #242738 text/plain mime type: Created attachment 242738 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D242738&action= =3Dedit send ppp a CHAP challenge packet that overflows a buffer If a CHAP_CHALLENGE packet arrives with a challenge length greater than 148 bytes, chap_Input() will call mbuf_Read() in a way that writes beyond the 148-byte chap->challenge.peer buffer and into the end of struct datalink, overwriting (among others) the datalink.bundle pointer, which ppp subsequently dereferences. Here's an example 288-byte Ethernet PPPOE frame: xx xx xx xx xx xx yy yy yy yy yy yy 88 64 11 00 00 01 01 0c c2 23 01 02 01 0a ff ff ... the "01 02" is code=3DCHAP_CHALLENGE and ID=3D2 the "01 0a" is the length =3D 266 the first "ff" is the length of the challenge (alen in the code below) Here's the relevant code in chap_Input(): u_char alen; ...; bp =3D mbuf_Read(bp, &alen, 1); ...; bp =3D mbuf_Read(bp, chap->challenge.peer + 1, alen); I've attached a demo, pppoe21a.c, which produces a ppp core dump with this backtrace: #0 strlen () at /usr/src/lib/libc/amd64/string/strlen.S:47 #1 0x000000000022fb7c in chap_ChallengeInit (authp=3D0x800e45350) at chap.= c:495 #2 0x000000000022f167 in chap_Input (bundle=3D0x28bbb0 ,=20 l=3D0x800e5d600, bp=3D0x0) at chap.c:764 #3 0x000000000025edfc in Despatch (bundle=3D0x28bbb0 ,=20 l=3D0x800e5d600, bp=3D0x800e45800, proto=3D49699) at link.c:381 #4 0x000000000025ecaf in link_PullPacket (l=3D0x800e5d600,=20 buf=3D0x800e60740 "\302#\001\002\001\n", '\377' ...,= =20 len=3D268, b=3D0x28bbb0 ) at link.c:323 #5 0x00000000002717f4 in physical_DescriptorRead (d=3D0x800e5e578,=20 bundle=3D0x28bbb0 , fdset=3D0x800e88140) at physical.c:569 #6 0x0000000000245825 in ether_DescriptorRead (d=3D0x800e5e578,=20 bundle=3D0x28bbb0 , fdset=3D0x800e88140) at ether= .c:426 #7 0x000000000023f783 in datalink_Read (d=3D0x800e43000,=20 bundle=3D0x28bbb0 , fdset=3D0x800e88140) at datalink.c:474 #8 0x0000000000226433 in bundle_DescriptorRead ( d=3D0x28bbb0 , bundle=3D0x28bbb0 ,=20 fdset=3D0x800e88140) at bundle.c:546 #9 0x00000000002635c8 in DoLoop (bundle=3D0x28bbb0 ) at main.c:661 #10 0x0000000000262abc in main (argc=3D4, argv=3D0x7fffffffe9e0) at main.c:= 535 (gdb) print authp->physical->dl->bundle $3 =3D (struct bundle *) 0xffffffffffffffff The 0xfff... comes from the payload of the packet. --=20 You are receiving this mail because: You are the assignee for the bug.=